Managed IT Services Archives

EternalBlue Hacks & Tales from the Unpatched (Video)

by EstesCloud | Jul 22, 2020 | Managed IT Services, Network Security, Security

EternalBlue, which is an ancient set of hacks — ancient: going back three years — is still applicable, especially in regard to some of the technology and vulnerabilities that we are seeing today. EternalBlue is a software that the NSA developed to hack Windows machines. The goal was to break into a computer (without telling the owner “someone’s there”) — and then run a software of choice. Windows contains more than two millions lines of code, so nobody, even at Microsoft, really knows what it’s all doing, and vulnerabilities are found every day. EternalBlue hacks targeted some of those vulnerabilities.

Running Windows makes you vulnerable by default. Linux, Mac, Android, iPhone — they’re all vulnerable because we’ve reached the state of complexity in the operating systems that we choose to run that it’s just a matter of time before new ways are found to break into these systems. Online trickery happens, and people download malware thinking they’re getting a good piece of software. For example, there was once a program called Whack-a-Mole. It was known to have a Trojan in it, so if hackers were able to convince you “hey, this is the coolest game in town,” then your machine would be infected. When hackers are trying to break into a machine, whether through a means like Whack-a-Mole or through an EternalBlue hack, they’re trying to do it surreptitiously, invisibly. They don’t want you to know because, if you knew, you might do something like reboot. This led the hackers to ratchet up what we call the “persistence” of malware, so that maybe it could survive a reboot.

If you’ve ever had a browser toolbar appear in Internet Explorer, or Chrome or Firefox or Edge, or any other browser, that toolbar probably has the rights to see wherever you’re surfing and modify the webpages that you get back, and can even interact with you. A toolbar is a very visual indicator that “you’ve been hacked.” Is that toolbar interested in stealing your passwords and learning your PayPal login and modifying what you visit and how you see it? Maybe, maybe not. But it’s an indication that you’re running untrusted software. Going out to the web and downloading a piece of software because it looks interesting is almost a guaranteed way to get hacked.

WannaCry

Malware programmers write apps, publish them and they get downloaded, and in the background there’s a malware stealing passwords, modifying webpages, looking at your identity — those are all activities I would consider hacks — and that’s what EternalBlue is. In short, it leverages a vulnerability that the NSA found in the Microsoft SMB protocol. They found that if they hurled a packet that was the right size in the right shape, it would shove a square peg into a round hole, and the round hole wouldn’t know what to do, and so it would execute a buffer overflow attack. Windows wasn’t expecting a square peg in a round hole, so it would trip, fall down, and execute code of the attacker’s choice. EternalBlue hacks took advantage of a “round” Server Message Block (SMB) hole, and as that SMB failed, it could run a Trojan, or blue screen a computer, or download a piece of malware.

Less than thirty days after EternalBlue got into the hands of cybercriminals, a nasty bug called WannaCry was released to the world. It made you want to cry because it was ransomware. It used EternalBlue as the delivery exploit, so as soon as WannaCry got a foothold inside a corporate network, it would jump from machine to machine to machine and ransom. By the next year, EternalBlue hacks had cost companies and industries billions of dollars, and 65 countries have fallen to EternalBlue’s vulnerability and have been ransomed or hacked in some fashion. Why? Because even after Microsoft released a patch, millions of computers were unprotected because people didn’t patch.

Patching… and more than patching

Cybercriminals are continually waiting for time, opportunity, and tools to be able to successfully hack into your system. To prevent it, we do a number of things. We patch our machines, we turn on our firewalls, and we don’t let people be local administrators. We make sure our antivirus is current. But we need more than antivirus because hackers now have toolkits to program custom malware. They don’t have to know about EternalBlue hacks if they have a malware toolkit. These toolkits change malware by a byte or two bytes, which changes the signature of the program. As a result, the antivirus software, which is looking for signatures, can’t detect the malware. This designer malware is specifically written for a particular company. The malware is one-of-a-kind and still does the same EternalBlue exploit. Because of this dark web exchange of malware toolkits and designer ransomware, more robust cybersecurity measures, like endpoint security, are needed to keep our businesses safe.

IF Only Tech Time

Fridays – Noon (MT)

Answers to all things about IT

IF you did miss IT… did you miss IT!? No worries!

Watch a tech talk here!

In-House, Web-Based or Private Cloud Solutions

by EstesCloud | Jul 7, 2020 | Cloud, Hosting, Managed IT Services, Software

If only purchasing software for business enablement could be as simple as tapping a button in an app — click once for on-premise installation, twice for web-based deployment, thrice for private cloud solutions. When considering software, users normally think about features and capabilities intuitively — making big decisions seem easy at first. This stems from the hope that core data and program logic is consistent across platforms.

Server virtualization, the World Wide Web and cloud computing have changed the dynamics of software development, acquisition, installation and deployment.

However, new technology often becomes a point of stagnancy, or even complacency, for businesses. This can sometimes result from hesitancy, but it’s often caused by oblivion.

How Will You Know What You Don’t Know?

Technology changes quickly, and the evolutions now, more often than not, push web-based and private cloud solutions away from the realm of preference and into the world of necessity. When I first entered the business field in the 90s, I never would have imagined that I could license a software application on a subscription service, much like I do a newspaper or magazine. My mind hadn’t even conceptualized the idea that a software application could be accessed entirely through the World Wide Web. Back in the day, we were just trying to make it through Y2K in one piece. But as the technology advanced, the options and opportunities presented themselves, and now more than two decades later, I increasingly work with companies engaging software in a cloud context.

IT Symbiosis

The industry shift to public and private cloud solutions has not only changed the very way in which applications are deployed, it has also leveled the playing field. Your company can now outsource some or all of your IT needs, allowing for growth within a predictable technology budget. A partnership with a managed services firm provides updates, compliance, security, training — all from a specialized team built specifically to adapt 24/7 to the volatile growth inherent to IT. Companies no longer need to house their own elaborate, expensive IT departments to keep up with the times. In light of recent cybercrime upswings, this is a critical time to focus on the survival of small and midsize businesses, which often face closure upon ransomware or other security breaches.

Since technology evolves on a daily basis, it’s always time for your team to consider new possibilities to protect the future of your business. If your architecture is outdated, or you’re overdue for a security audit, it might be time to get a full analysis of your IT infrastructure. Moving from on-premise servers to hosted, cloud-based environments can be one way to ensure business continuity. That said, “the cloud” might not be the right fit for your business, so let’s look more closely at business enablement through three common deliveries, which can be infinitely customized into hybrid forms.

The Basics

The deployment of an application normally takes on one of the following forms:

On-Premise: In an on-premise installation, the application is installed on an on-premise, in-house server. It can be like having a furnace closet or an underground mad scientist laboratory, depending on the size of the company and the specific technology burden.
Cloud-Hosted: Cloud-hosted applications are installed on a virtual server, which means they are hosted in the cloud. Hosted solutions often replicate an on-premise architecture. Ease of backups, cybersecurity, updates and compliance are common reasons businesses choose cloud-based solutions. This option allows organizations to leverage 100% of the application features that are available in an on-premise install.
Web-Based: A web-based deployment foregoes installation entirely — it’s based on subscribing to an application that is already installed, deployed, and interacting with the application through web-based protocols.

A common trope of cloud computing with regard to on-premise installations has to do with the limits in physical contact that it presents — you can’t go down the hall and hug your servers. I’ve never actually tried to hug a server, but I think it would feel rather strange to do so. This hug-ability factor speaks to the level of control that companies possess when they install an application on their in-house server stack. There might be problems with this approach, but at least the company owns the problems and their resolutions. Moreover, when it comes to hugging, data is a much more recognizable object of affection. I can think of countless times that I have tried to “get my arms around the data” when working on a project. Access to the data layer is often an important feature, especially when performing custom reporting, and in some cases, the abstraction of the data layer present in web-based applications may make it hard to understand just what is happening to the data itself, making reporting a challenge.

Purely web-based versions of an application provide the core capabilities, but the features and functionalities available in a web-based version tend to be limited when compared to their on-premise counterparts. Consider Microsoft’s Office 365 suite. While highly similar to a client install, there are some limitations to the things we can accomplish in the web version of Excel, for instance, when compared to its client-based counterpart. Working with ERP systems, I’ve found this trend to be consistent — if you’re leveraging a web-version of an application, expect to be privy to a subset of the overall functionality available with an on-premise version. And if you’re utilizing a version that is entirely web-based, tailor your expectations accordingly.

Speaking of tailoring, the ability to alter an application to fit your company’s needs also tends to be greatly reduced in web-based applications when compared to on-premise counterparts. By tailoring, I am referring to the ability to insert user-defined data or business logic into your application and have this custom functionality work in conjunction with the application’s standard behavior. In some ways this limitation is a good thing, as I’ve certainly seen companies entangle themselves in their own tailored threads. Conversely, a little tailoring can yield big gains in efficiency and effectiveness. As it is, a company purchasing web-based software out-of-the-box should understand what is in the box and only in the box, and that the box can’t be easily repurposed.

Depending on the application in question and the needs of the business, I‘ve found private cloud solutions to be a nice midpoint between the two poles of on-premise and web-based architectures. Cloud hosting specifically allows companies to possess fully-featured applications in the cloud, avoiding the problems associated with on-premise installations. This affords a measure of control unavailable with pure web-based applications. Moreover, it creates the levels of functionality and customizability that allow companies to do more than the basics. And should the company need assistance in the management of their application stack, we can cleanly pull in additional resources to lend a hand. Hosted applications also offer a variety of administration options — from in-house talent to partnered resources — and can adapt efficiently to new technology.

A security assessment provides a system overview. It allows you to see if your team is overworked or poorly protected. Time to begin? Our team is ready to help, whether you’re on-premise, web-based, or in a private cloud.

[pardot-form id=”1668″ title=”Network Assessment”]

Dark Web Protection: Assessment, Awareness & Actualization

by Brad Feakes | Jul 1, 2020 | Managed IT Services, Network Security, Security

Business owners, especially those who have been through the challenges involved in a data breach, often hope the dark web goes completely dark — as in nonexistent. Wouldn’t it be nice if trending IT services, like advanced web scans and security audits, go out with the times? For now, the illegal realm of the dark web makes history every day, so companies must work nonstop to predict cyber threats and stay a step ahead of the hackers.

Dark Exposure

The dark web is an encrypted network of criminal intent. The deep web, conversely, provides a safe haven for your private information. By law, you need to keep most of your business data hidden from public view. You don’t want your financial information or your employees’ social security numbers exposed, and neither does the government. Whether you’re a manufacturing company in the heart of Denver, Colorado, or a distribution business with hubs across the country, you need hidden security — call it “dark web” protection — for massive amounts of corporate data. This means you’ll need to keep your real-time data and your backups in the deep web and out of the dark web.

The deep web is essential to privacy, compliance, safety and security. Like the illegal areas of the web, it’s built from non-indexed pages. Your company’s network is not revealed to random viewers because it’s kept hidden in the deep web — unless you suffer a data breach that exposes your information to malcontents.

To Breach Their Own

People feel vulnerable online and are somewhat aware that cyber danger is lurking. However, data breaches often originate in too much trust or in lack of communication surrounding network trust issues. Your users trust an email and get phished, or they trust “12345” as a solid password. Could the problem be that your users trust the company to protect them? Does your team assume that strong security solutions are already in place? Here are some of the common reasons, stemming from the trust factor, that your business could suffer cyber attacks:

spam email
weak passwords
unprotected mobile devices
delayed software updates

Mix these with user oblivion (or trust) and flimsy (or outdated) policies, and your company is at high risk for a cyber attack.

“A” for Security

Let’s now look at 3 “Easy A” ways you can create safe deep web data:

Assessment: A security audit is an excellent way to surface your network’s weak points. You can immediately see vulnerabilities and close openings that could bring in hacker traffic.
Awareness: Users often trust the system. Cybersecurity awareness training, such as a fire drill phishing attack, can educate users about current cyber risks and prepare them for real-time attacks.
Actualization: Enriching and enforcing security policies, updating hardware and software, advancing network protection measures — there are hundreds of ways to make advanced security a reality for your company.

When was the last time you had a security audit? Have you ever clicked on a suspicious link because of mental fatigue or, the opposite, heightened curiosity? When did you last test your backups? Install updates? Scan the dark web for your private data? Did you ever turn off multi-factor authentication because it was annoying? If you assess your system and close obvious gaps, train the users accessing your corporate network, and actualize things like security in the cloud and advanced endpoint security, you can leave the hacker chapter out of your company’s history books.

Are you ready to protect your business from the hackers?

Our team can help you with assessment, awareness and actualization.

Getting QWERTY with Password Management

by EstesCloud | Jun 22, 2020 | Cloud, Managed IT Services, Network Security, Security

Before the Time Runs Out!

Day(s)

Hour(s)

Minute(s)

Second(s)

Forget Your Password? Click Here!

Common Password Management Security Mistakes

qwerty, password, 12345, iloveyou, 111111, 54321

An average individual comes into daily contact with a variety of personal apps, websites, remote connections and enterprise applications. And this concoction of connections brings with it a variety of access and authentication requirements. Successfully navigating the gauntlet of our digital world, especially when going public, private, or hybrid cloud, without exposing yourself to significant security risks can be a challenge. In practice, the vulnerabilities are pronounced. A quick look at the most common passwords of 2018 is concerning: 123456, password, 123456789, 12345, 111111, 1234567, sunshine, qwerty, iloveyou.

Access management has become the norm

The challenges of managing one’s passwords are complicated by the differing requirements of different platforms—password conventions, expiration cycles and authentication methods make the task of organizing one’s suite of credentials daunting. One cans see how these challenges lead people to simplify their passwords, sacrificing security for simplicity.

iloveyou2

Password proliferation has become the norm. With every new app, website and device that we commandeer, there’s new access information created. Moreover, many of these systems require a periodic reset. Keeping track of all of these passcodes can be likened to taking a mnemonic census of an anthill.

Archimedes once said that if only he had a solid rock on which to stand, he would move the earth.

If you assume that your passwords are a firm footing, prepare to have your assumptions rocked. It is believed that up to 80% of common hacking activities are due to compromised credentials, mostly in the form of stolen usernames and passwords. Worse still, IT Managers report 73% of all passwords used are duplicated in multiple applications. When people use the same password for multiple systems, having one password exposed may compromise the whole network of applications. Luckily, password management doesn’t mean you have to buy a walk-in safe to store your password diaries. To keep it simple, here are a few tips to memorize as a starting point for improved password management:

Never use the same password twice
Never write down your passwords
Never share your passwords with anyone else
Never use real words or known information about yourself in your passwords
Avoid commonly used passwords

The last bullet is especially salient—50% of all attacks involve the top 25 most used passwords, proving there are risks involved in “getting qwerty” with your password management procedures.

Need a more sophisticated password management plan?

Let’s talk password management solutions and multi-factor authentication, two great ways to prevent getting hacked.

Password Manager: A password manager solution, such as SolarWinds’s PassPortal, allows you to store all of your passwords in one place. This makes managing and remembering all of them much easier. Make sure your password manager solution is itself password protected, preferably with multi-factor authentication.
Multi-factor authentication: Multi-factor authentication is the use of additional forms of authentication in conjunction with a traditional password. This most often takes the form of a shared key, sent to a separate device, or calculated through a common authentication application. This makes it difficult for a compromised password to compromise the application. Enable multi-factor authentication wherever possible, but make sure your secondary authentication source is equally secured with a strong password—failure to do so is like having a biplane write your shared key in the sky.

qwertyiloveyou2!

Random password generators can also help create passwords, but the results are often long random jumbles of characters and quite difficult to remember. Unless you can recite the longest word in the world from memory, you might want to use these password management tools in conjunction with a password management solution. If you’re a business owner trusting dozens or hundreds or thousands of employees with sensitive information, then a managed IT solution that includes password management will definitely be the safest way to interact with the millions of letters, numbers and characters that are involved in the multitude of passwords that access the data of your systems.

IT Services in a 1 + 1: 4 Signs You Need Managed IT

by EstesCloud | Jun 5, 2020 | Cloud, Hosting, Managed IT Services, Security

The word “outsourced” makes some business owners curious and others nervous when it comes to IT services. “MSP” is another term floating around, and you might also come across “IT-in-a-Box” when you go looking for help with your systems. Managed IT (our favorite code phrase) can mean a lot of things. If you’re a manufacturing or distribution company, then IT services might mean, among other things, industry-specific Cloud or Hosting platforms.

When Nobody Sees the IT Stop Signs

When it comes to your ERP and IT systems, you need effective stop signs that work both internally and externally. Your cybersecurity infrastructure can keep your team safe and productive while also keeping the bad guys out. Cybercrime is a 1 + 1 relationship. If you didn’t have a team to be hacked, then you wouldn’t ever need to worry about adding a hacker to your network.

Stop Sign 1: Your company’s IT services need to ensure that your employees are traveling through safe pathways and that they know when to stop before falling into the webs of ransomware or other destructive malware.
Stop Sign 2: Your team’s mobile devices, laptops and desktops all make friends on a daily basis. This is essential for business growth. Because of this, IT services ideally provide a clear STOP sign for potential trespassers—a bold indication that cyber tricksters will not be tolerated, even on the fringes, and will not be unknowingly welcomed in by your team.

A Wanted Man or a Wanted Spam?

But how do you know if your system has a “Most Wanted” sign that’s attracting criminals rather than telling them you already know they’re the lawbreakers? When it comes to business, you’re continually building relationships, and hopefully these become lifelong friendships. You trust your most valuable data to your IT talent. When it comes to managed IT services, business owners and other decision-makers might squint at the cyber lineup and not know whom or when to choose. Here are 4 signs your staff would benefit from a partnership with a managed IT and cybersecurity firm:

High-value IT projects, best done internally, are distracting your key players or forcing them to work long hours.
IT operations are unpredictable or unreliable, causing project or system failures, yet you don’t want to grow or change your employee pool.
IT costs are variable or steep, and you’d like a more predictable budget.
Security and compliance issues are overwhelming your team.

Every second of the day you rely on experts to protect you. The meteorologists warn you of bad weather. The firefighters alert you when it’s a fire risk to roast a s’more. The doctors warn you of heart attack predisposition. In regard to IT, the challenges you face include ransomware that could destroy the business you’ve worked so hard to build. This holds true whether you’re a DoD manufacturer, a medical clinic, an accounting firm, a lollipop distributor, a small-town bank… the list goes on. Because the hackers are always available to friend you, you’re always risking adding them to your inner circle, making your 1 + 1 relationship one of IT enemies, rather than friends. A 1 (your team) + 1 (EstesGroup Managed IT services team) relationship will keep your IT math simple, your budget profitable, and your company safe.

Are you looking to add a friendly IT expert to your network? Is your IT department working overtime to keep up with security, compliance, updates, backups or other system projects on your company table? Chat with us today!

Mobile Device Theft Prevention Tips

by EstesCloud | Jun 3, 2020 | Business Consulting, Managed IT Services, Security

Cell Phone Theft Prevention: Digital Assets vs. Liabilities

With more people working outside of the office, companies need to prepare their employees for the possibility that company and personal mobile devices could be lost to theft or misplacement. Remotely securing users can be a challenge for small companies and large companies alike. Fortunately, there are easy ways that companies and employees can prepare and prevent the loss or theft of devices before it happens. Whether you have a mobile device or a hardwired PC, these device prevention tips can ensure that your phones and laptops are assets, rather than liabilities.

Step 1: Make sure your device is locked and so are the apps!

In this day and age, most laptops and other portable devices can be locked (both physically and by using a passcode). Yet, anyone hanging out at a coffee shop will notice many people going to the restroom, paying for food or going outside to take a call with their devices left unattended and unlocked. Don’t be that person and become the victim of theft or loss (or even a drive-by malware install). The likelihood of theft in such public and transient locations tends to be high, and relying on the video camera of the theft doesn’t guarantee the return of the device. Take your devices in a bag with you if you leave the location any reason and also when you don’t have a direct line of sight on you and your company’s belongings.

When walking in crowded locations make sure to close all of your bag openings (lock them if you can) and be aware of how easily a device could be taken without your knowledge. Visible and unsecured devices are targets of thieves and could fall out of whatever you are holding them inside. Having a cell phone with critical information in the back pocket of your jeans is an invitation for accidents or worse to happen. Cell phone theft prevention needs to be proactive. Know where your device is at all times and know how to prevent both physical and digital theft.

Step 2: Know where your devices are located.

Most phones have the capability to track where you might have left it or where someone has taken it. These features are great but you can also step it up a notch with 3rd-party tools made for this purpose. A simple search will yield a number of location security applications built for business consumers.

In addition to 3rd-party applications that can help you find devices, if you want to add another layer of security there are a few physical GPS devices available. These small devices are not prohibitively expensive and can be slipped into a phone/tablet case, a briefcase or a backpack for an extra layer to identify where a device is located.

Step 3: Consider having the device engraved or having return information placed on the device

Another tip that is overlooked but important is to have devices engraved so you can add return (and reward) information in the event that a device is misplaced. If engraving is not possible, a sticker with your contact details is also another useful option. Not everyone is out to steal your device. Mobile device theft prevention savvy also protects you from your data ending up in a lost & found box. Sometimes we simply misplace our laptops or phones, so leaving contact details in the event of a loss will facilitate the return of your device.

Step 4: Encrypt or remove sensitive information

Luckily there are plenty of options to encrypt information on your devices. Not only do many operating systems provide you with encryption options, but there are also many 3rd-party applications to help you. VeraCrypt is a free/open-source disk encryption software that’s worth considering if you are looking for free options.

Beyond encrypting sensitive data, developing a mindset of being rigorous about the removal of sensitive data (that includes photos of sensitive information) will help you avoid unwanted access to your devices that might hold sensitive information.

Cyber Thieves vs. Cyber Peace

While loss prevention isn’t always avoidable, these tips will help to reduce the probability of loss or theft and ensure we are doing everything to prevent our devices and the sensitive data (like information protected by HIPAA) from being accessed by unwanted individuals, hackers, or dark web cybercriminals. If you do become a victim of device theft, or if you lose your device, then EstesCloud BDR, or a similar disaster recovery solution, can help return cyber peace to your world of data. Cell phone theft prevention is becoming a more critical issue for businesses because remote workers often install work apps on their iPhones, Samsung Galaxies, or other competing brands.